Role in IT decision-making process:Align Business & IT GoalsCreate IT StrategyDetermine IT NeedsManage Vendor RelationshipsEvaluate/Specify Brands or VendorsOther RoleAuthorize PurchasesNot Involved

Work Phone:

Company:

Company Size:

Industry:

Street Address

City:

Zip/postal code

State/Province:

Country:

Occasionally, we send subscribers special offers from select partners. Would you like to receive these special partner offers via e-mail?YesNo

Your registration with Eweek will include the following free email newsletter(s):News & Views

By submitting your wireless number, you agree that eWEEK, its related properties, and vendor partners providing content you view may contact you using contact center technology. Your consent is not required to view content or use site features.

By clicking on the "Register" button below, I agree that I have carefully read the Terms of Service and the Privacy Policy and I agree to be legally bound by all such terms.

Microsoft Fixes a Dozen Security Flaws, Nine Critical

Of the 12 vulnerabilities reported by the software maker, nine were identified as critical issues, including problems in Explorer, Outlook Express and PowerPoint.

Microsoft released a dozen security bulletins on Aug. 8 in an effort to patch a variety of security issues affecting Windows and Office, including nine critical vulnerabilities present in popular applications such as Internet Explorer, Outlook Express and PowerPoint.

Ten of the dozen security bulletins addressed issued by the Redmond, Wash.-based software maker include patches for its flagship Windows operating system, including the seven labeled as critical, Microsofts highest severity rating.

For the third successive month, the company also issued patches for critical vulnerabilities in Microsoft Office.

Among the critical Windows flaws, Microsoft issued a cumulative bulletin for its Internet Explorer Web browser, which promises to resolve several vulnerabilities that could allow outside attackers to take over a device running the software via remote code execution attacks.

The issue addressed in Microsofts Outlook Express e-mail software also involves a flaw that could allow for machines to be compromised through remote code execution attacks.

The problem, identified by Microsoft as a MHTML parsing vulnerability, could allow the machines of Outlook Express users to be taken over by attackers who could then log on with administrative user rights to manipulate data or create new accounts with full user rights.

Microsoft said that an attacker could exploit the vulnerability by constructing a specially crafted Web page or HTML e-mail that could potentially lead to remote code execution if a user visited a related Web site or clicked a link in a specially crafted message.

If a user were logged on with administrative user rights, an attacker could then take complete control of an affected system.

Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights, the company said.

Other critical Windows bulletins included a fix meant to address a vulnerability in the softwares server service that could allow for remote code execution.

That flaw involved a buffer overrun which could be used to take over a computer running an unpatched version of the program.